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(54) Method for securing over-the-air communication in a wireless system 



(57) In the method for securing over-the-air commu- 
nication in wireless system, a mobile sends a system 
access request and dummy data associated with the 
system access request to a network. The network sends 
a first data stream including a first data portion to the 
mobile in response to the system access request and 
the dummy data. The mobile extracts the first data por- 
tion from the first bit stream, and sends a second bit 
stream to the network. The second bit stream includes 
a second data portion. The mobile and the network both 
generate a key based on the first data portion and the 
second data portion, and establish a first encrypted and 
authenticated communication channel in cooperation 
using the key. The mobile then transfers authorizing in- 
formation to the network over the first encrypted and au- 
thenticated communication channel. If accepted, a sec- 
ond encrypted and authenticated communication chan- 
nel is established. The network then sends sensitive in- 
formation such as the root or A- key to the mobile over 
the second encrypted and authenticated communica- 
tion channel. 
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Description 
Related Applications 

[0001] The following applications, filed concurrently s 
with the subject application, are related to the subject 
application and are hereby incorporated by reference in 
their entirety: application no. unknown entitled METH- 
OD FOR TWO PARTY AUTHENTICATION AND KEY 
AGREEMENT by the inventor of the subject application; io 
application no. unknown entitled METHOD FOR UP- 

r> ftrmr* OC^O^ *■ f7>«— o- r> % « a MHn<-i t— ^ 

nxu ouwi ic i Oi mi lCu uni r\ 1 1 m r\ ¥vi ntLCOO 

COMMUNICATION SYSTEM by the inventor of the sub- 
ject application; application no. unknown entitled 
METHOD FOR TRANSFERRING SENSITIVE INFOR- 75 
MATION USING INTIALLY UNSECURED COMMUNI- 
CATION by the inventor of the subject application; and 
application no. unknown entitled METHOD FOR ES- 
TABLISHING A KEY USING OVER-THE-AIR COMMU- 
NICATION AND PASSWORD PROTOCOL AND PASS- 20 
WORD PROTOCOL by the inventor of the subject ap- 
plication and Adam Berenzweig. 

Field Of The Invention 

25 

[0002] The present invention relates to a method for 
securing over-the-air communication in a wireless sys- 
tem. 

Description Of Related Art 30 

[0003] In a wireless communication system, the hand- 
sets, often called mobiles, purchased by mobile users 
are typically taken to a network service provider, and 
long keys and parameters are entered into the handset 35 
to activate service. The network of the service provider 
also maintains and associates with the mobile, a copy 
of the long keys and parameters for the mobile. As is 
well-known, based on these long keys and parameters, 
information can be securely transferred between the *o 
network and the mobile over the air 
[0004] Alternatively, the user receives long keys from 
the service provider over a secure communication chan- 
nel, like a telephone/land line, and must manually enter 
these codes into the mobile. 45 
[0005] Because the transfer of the long keys and pa- 
rameters is performed via a telephone/land line or at the 
network service provider as opposed to over the air, the 
transfer is secure against over the air attacks. However, 
this method of securely transferring information places so 
certain burdens and restrictions on the mobile user. 
Preferably, the mobile user should be able to buy their 
handsets and then get service from any service provider 
without physically taking the handsets to the provider's 
location or having to manually and error free, enter long 55 
keys into the mobile. The capability to activate and pro- 
vision the mobile remotely is part of the North American 
wireless standards, and is referred to as over the air 



service provisioning" (OTASP). 

[0006] Currently, the North American Cellular stand- 
ard IS41 -C specifies an OTASP protocol using the well- 
known Diffe-Hellman (DH) key agreement for establish- 
ing a secret key between two parties. Fig. 1 illustrates 
the application of the DH key agreement to establishing 
a secret key between a mobile 20 and a network 1 0 used 
in IS41 -C. Namely, Fig. 1 shows, in a simplified form for 
clarity, the communication between a network 10 and a 
mobile 20 according to the DH key agreement. As used 
herein, the term network refers to the authentication 

C eft its f 5, ftCiTft? iCCcuiOTi M3yi5»efo, viomnQ iOCaiiOii fczyiS- 

ters, mobile switching centers, and base stations oper- 
ated by a network service provider. 
[0007] The network 10 generates a random number 
R N , and calculates (g^M mod p). As shown in Fig. 1, 
the network 10 sends a 512-bit prime number p, a gen- 
erator g of the group generated by the prime number p, 
and (g A R N mod p) to the mobile 20. Next, the mobile 20 
generates a random number F^, calculates (g/N^M mod 
p), and sends (g A R M mod p) to the network 10. 
[0008] The mobile 20 raises the received (g A R N mod 
p) from the network 10 to the power R M to obtain (g A R M _ 
R N mod p). The network 1 0 raises the received (g A R|y| 
mod p) from the mobile 20 to the power R N to also obtain 
(g A R M R N mod p). Both the mobile 20 and the network 
1 0 obtain the same result, and establish the 64 least sig- 
nificant bits as the long-lived or root key called the A- 
key. The A- key serves as a root key for deriving other 
keys used in securing the communication between the 
mobile 20 and the network 10. 

[0009] One of the problems with the DH key exchange 
is that it is unauthenticated and susceptible to a man- 
in-the-middle attack. For instance, in the above mobile- 
network two party example, an attacker can imperson- 
ate the network 10 and then in turn impersonate the mo- 
bile 20 to the network 10. This way the attacker can se- 
lect and know the A-key as it relays messages between 
the mobile 20 and the network 10 to satisfy the author- 
ization requirements. The DH key exchange is also sus- 
ceptible to off-line dictionary attacks. 

Summary Of The Invention 

[0010] The method for securing over-the-air commu- 
nication in wireless system according to the present in- 
vention disguises an OTASP call as a normal system 
access to defeat attacks. According to the present in- 
vention, a mobile sends a system access request and 
cummy data associated with the system access request 
to a network. The network sends a first data stream in- 
cluding a first data portion to the mobile in response to 
the system access request and the dummy data. The 
mobile extracts the first data portion from the first bit 
stream, and sends a second bit stream, which includes 
a second data portion, to the network. The network ex- 
tracts the second data portion from the second data 
stream. 
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[0011] Both the mobile and the network generate a 
key based on the first data portion and the second data 
portion, and establish a first encrypted and authenticat- 
ed communication channel using the key. The mobile 
then transfers authorizing information to the network s 
over the first encrypted and authenticated communica- 
tion channel. If accepted, a second encrypted and au- 
thenticated communication channel is established. 
Over the second encrypted and authenticated commu- 
nication channel, the network then sends sensitive in- 10 
formation such as the root or A-key to the mobile. 

[001 2J Ar^ 3tt3Ck3f m OP. ! tC ri P. rt !hs £orr>rn«jni^3tioo ho, 

tween the mobile and network according to the present 
invention would recognize the communication as a nor- 
mal system access, and presumably fail to mount an at- is 
tack. However, if an attack is mounted, an attacker must 
block a significant number of system accesses to find a 
disguised OTASP call. This denial of service to mobile 
users makes locating and stopping an attacker fairly 
easy. 20 

Brief Description Of The Drawings 

[001 3] The present invention will become more fully 
understood from the detailed description given below 2s 
and the accompanying drawings which are given by way 
of illustration only, wherein like reference numerals des- 
ignate corresponding parts in the various drawings, and 
wherein: 

30 

Fig. 1 shows the communication between a network 
and a mobile according to the Diffe-Hellman key 
agreement; and 

Fig. 2 shows the communication between a network 3S 
and a mobile user according to an embodiment of 
the present invention. 

Detailed Description Of The Preferred Embodiments 

40 

[0014] The system and method according to the 
present invention protects the over-the-air transfer of in- 
formation between the mobile 20 and the network 1 0 by 
disguising the transfer as a normal system access. For 
the purposes of discussion only, the system and method 45 
according to the present invention will be described with 
respect to the transfer of the A-key by disguising the 
transfer as a call origination system access. 
[0015] As discussed previously, during service provi- 
sioning, the mobile 20 and the network 10 need to es- so 
tablish an A-key for future encrypted communication. 
According to the present invention, during this initializa- 
tion process, such as when the mobile 20 is first activat- 
ed, the mobile 20 generates a random number DID as 
a dummy identification number for the mobile 20, and ss 
generates another random number DMIN as a dummy 
telephone number for the mobile 20. The mobile 20 then 
sends a call origination request, the dummy identifica- 



tion number DID and the dummy telephone number 
DMIN to the network 10 over an access channel as 
shown in Fig. 2. Fig. 2 shows the communication be- 
tween the network 10 and a mobile 20 according to an 
embodiment of the present invention. 
[001 6] Because the dummy identification number DID 
and the dummy telephone number DMIN are dummy 
values, the network 10 fails to recognize the dummy 
identification number. DID and the dummy telephone 
number DMIN as legitimate numbers. Such a situation 
could result due to error, or because the mobile 20 is 
trying to establish » disonised OTASP. The network 10 
continues to "pretend" the call is normal by sending a 
first bit stream over a voice channel to the mobile 20. 
The first bit stream may be a predetermined and pre- 
stored bit stream or a randomly generated bit stream, 
but is indistinguishable from the bit stream of an encrypt- 
ed voice channel. However, the network 10 sends (g*F\ N 
mod p) at a first predetermined position, which is pre- 
stored by both the mobile 20 and the network 10, in the 
first bit stream. 

[0017] The mobile 20 extracts (g^ mod p) from the 
first bit stream, and generates a random number R M . 
The mobile 20 calculates (g A R M mod p), and further cal- 
culates (g A R N modpJ^Rju, which equals (g A R N R M mod 
p). The mobile 20 selects (g^Ru mod p), a hash 
thereof, or a portion thereof as the session key SK. The 
mobile 20 also sends a second bit stream over the voice 
channel to the network 10. The second bit stream may 
be a predetermined and pre-stored bit stream or a ran- 
domly generated bit stream, but is indistinguishable 
from the bit stream of an encrypted voice channel. How- 
ever, the mobile sends (g*R M mod p) at a second pre- 
determined position, which is pre-stored by both the mo- 
bile 20 and the network 10, in the second bit stream. 
The first and second predetermined position can be the 
same or different positions. 

[0018] Thenetwork 10extracts (g*F\ M mod p) from the 
second bit stream, and calculates (g^M mod p) A R N , 
which equals (g^R^M mod p). The network 10 selects 
(g A R|sjR^ mod p), a hash thereof or a portion thereof, in 
the same manner as did the mobile 20, as the session 
key SK. Accordingly, the network 10 and the mobile 20 
have established the same session key SK. 
[0019] Next, after a predetermined period of time (e. 
g., ten seconds), communication between the mobile 20 
and the network 10 over the voice channel is encrypted 
using the session key SK as a root key (A-key) accord- 
ing to any well-known protocol such as IS41 -C. Further- 
more, the voice channel is message authenticated using 
any well-known message authentication algorithm such 
as the HMAC algorithm. 

[0020] The mobile user then supplies the network 10 
with authorizing information (e.g., credit cardnumberfor 
billing purposes, etc.) over the encrypted and authenti- 
cated voice channel. Once the authorizing information 
has been verified by the network 10, the network 10 
sends the A-key to the mobile 20 over a control channel, 
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which is encrypted and authenticated in the same man- 
ner as the voice channel. 

[0021] Afterthe encrypted and authenticated transfer 
of the A-key is complete, the network 1 0 and the mobile 
20 reconfigure communication based on the A-key. s 
[0022] Preferably, the protocol used for encryption, 
such as the IS41 -C protocol, is modified to perform au- 
thentication as disclosed in one of two concurrently filed 
applications by the same inventor entitled METHOD 
FOR TWO PARTY AUTHENTICATION and METHOD M> 
FOR PROTECTING TRANSFER OF INFORMATION 
OVER AN UNSECURED COMMUNICATION CHAN- 
NEL. The concurrently filed applications entitled METH- 
OD FOR TWO PARTY AUTHENTICATION and METH- 
OD FOR PROTECTING TRANSFER OF INFORMA- is 
TION OVER AN UNSECURED COMMUNICATION 
CHANNEL, by the Inventor are hereby incorporated by 
reference in their entirety. 

[0023] An attacker monitoring the communication be- 
tween the mobile 20 and the network 10 would recog- 20 
nize the call origination request, and subsequently be- 
lieve that a call was taking place based on the data 
transfer over the voice channel. Because the first and 
second bit streams do not convey recognizable voice 
information, an attacker must assume that the voice 25 
channel is encrypted. However, not until a predeter- 
mined period of time after the network 1 0 generates the 
session key SK does the voice channel become en- 
crypted. 

[0024] The only way for the attacker to act as a man- 30 
in-the-middle is to do so with most of the on-going calls, 
and hope that one of the calls is the above-described 
OTASP call. To have any significant probability of finding 
an OTASP call, the attacker will have to block most of 
the calls because an OTASP call is a rare event. Call 35 
origination, however, is very frequent. Consequently, if 
the attacker is blocking most calls, causing a denial of 
service, it becomes easier to find the attacker. It also 
becomes more important to find the source of the attack, 
and restore service to the mobile users. 40 
[0025] The embodiment of the present invention dis- 
cussed above assumes the mobile 20 and the network 
1 0 each store a predetermined prime number p and a 
predetermined generator g of p. As an alternative, the 
prime number p and the generator g are safely sent to *s 
one of the parties from the other party using any well- 
known technique for safely sending a prime number p 
and the generator g thereof. 

[0026] The invention being thus described, it will be 
obvious that the same may be varied in many ways, so 
Such variations are not to be regarded as a departure 
from the spirit and scope of the invention, and all such 
modifications are intended to be included within the 
scope of the following claims. 



Claims 

1. A method for securing over-the-air communication 
with a network, comprising: 

(a) sending a system access request and dum- 
my data associated with said system access re- 
quest tc a network; 

(b) receiving a first bit stream including a first 
data portion from said network; 

(c) extracting said first data portion from said 
first bit stream; 

(d) sending a second bit stream to said network, 
said second bit stream including a second data 
portion; 

(e) generating a key based on said extracted 
first data portion and said second data portion; 

(f ) establishing a first encrypted communication 
channel using said key. 

2. The method of claim 1 , wherein said step (c) ex- 
tracts said first data portion from a first predeter- 
mined position in said first bit stream. 

3. The method of claim 1 , wherein said step (d) sends 
said second data portion at a first predetermined 
position in said second bit stream. 

4. The method of claim 1 , wherein 

said first data portion represents (g^N mod p), 
where p is a prime number, g is the generator 
of a group generated by said prime number p 
and R N is a first random number; and 

said second data portion represents (g^M 
mod p), where R M is a second random number. 

5. The method of claim 4, wherein said step (e) gen- 
erates said key as (g A R N R M mod p). 

6. The method of claim 1 , wherein said step (f ) estab- 
lishes said first encrypted communication channel 
as an encrypted and authenticated communication 
channel using said key. 

7. The method of claim 1 , further comprising: 

(g) establishing a second encrypted communi- 
cation channel using said key; and 

(h) transferring authorizing information to said 
network over said second encrypted communi- 



4 



NSDOCID: <EP 0998080A2_1_> 



7 



EP 0 998 080 A2 



8 



cation channel; and wherein 

said step (f) is performed after said step (h) if 
said network accepts said authorizing information. 

8. The method of claim 7, wherein 

said step (f) establishes said first encrypted 
communication channel as an encrypted and 
authenticated communication channel using 
said key: and 

said step <g) establishes said second encrypted 
communication channel as an encrypted and 
authenticated communication channel using 
said key. 

9. The method of claim 7, wherein said second en- 
crypted communication channel is a voice channel. 

10. The method of claim 1 , wherein said step (a) sends 
a call origination request as said system access re- 
quest. 

11. The method of claim 1 , further comprising: 

(g) receiving sensitive information from said 
network over said first encrypted communication 
channel. 

12. The method of claim 11, wherein said sensitive in- 
formation is a root key. 

13. A method for securing over-the-air communication 
with a mobile, comprising: 

(a) receiving a system access request and 
dummy data associated with said system ac- 
cess request from said mobile; 

(b) sending a first bit stream, including a first 
data portion, to said mobile in response to said 
system access request and said dummy data; 

(c) receiving a second bit stream trom said mo- 
bile, said second bit stream including a second 
data portion; 

(d) extracting said second data portion from 
said second bit stream; 

(e) generating a key based on said extracted 
second data portion and said first data portion; 

(f) establishing a first encrypted communication 
channel using said key. 

14. The method of claim 13, wherein said step (d) ex- 
tracts said second data portion from a first prede- 



termined position in said second bit stream. 

15. The methodof claim 1 3, wherein said step (b) sends 
said first data portion at a first predetermined posi- 

s tion in said first bit stream. 

16. The method of claim 1 3, wherein 

said first data portion represents (g A R N mod p), 
10 where p is a prime number, g is the generator 

of a group separated by said prime number p 

sr.d H N is a first rar.de.™ n~rr,bor; and 

said second data portion represents (g A R M mcd 
15 p), where R M is a second random number. 

17. The method of claim 16, wherein said step (e) gen- 
erates said key as (g^R,^ mod p). 

20 18. The method of claim 13, wherein said step (f) es- 
tablishes said first encrypted communication chan- 
nel as an encrypted and authenticated communica- 
tion channel. 

2S 19. The method of claim 1 3, further comprising: 

(g) establishing a second encrypted communi- 
cation channel using said key; and 

30 (h) receiving authorizing information from said 

mobile over said second encrypted communi- 
cation channel; and wherein 

said step (f) establishes said first encrypted 
55 communication channel if said authorizing informa- 
tion is acceptable. 

20. The method of claim 19, wherein 

40 said step (f) establishes said first encrypted 

communication channel as an encrypted and 
authenticated communication channel using 
said key; and 

45 said step (g) establishes said second encrypted 

communication channel as an encrypted and 
authenticated communication channel using 
said key 

so 21. The method of claim 19, wherein said second en- 
crypted communication channel is a voice channel. 

22. The method of claim 13, wherein said step (a) re- 
ceives a call origination request as said system ac- 

5 5 cess request. 

23. The method of claim 1 3, further comprising: 

(g) sending sensitive information to said mo- 



SDOCID: <EP 0998080A2_I_> 



9 



EP 0 998 080 A2 



bile over said first encrypted communication chan- 
nel. 

24. The method of claim 23, wherein said sensitive in- 
formation is a root key. s 
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(54) Method for securing over-the-air communication in a wireless system 



(57) In themethod forsecuring over-the-air commu- 
nication in wireless system, a mobile sends a system 
access request and dummy data associated with the 
system access request to a network. The network sends 
a first data stream including a first data portion to the 
mobile in response to the system access request and 
the dummy data. The mobile extracts the first data por- 
tion from the first bit stream, and sends a second bit 
stream to the network. The second bit stream includes 
a second data portion. The mobile and the network both 
generate a key based on the first data portion and the 
second data portion, and establish a first encrypted and 
authenticated communication channel in cooperation 
using the key. The mobile then transfers authorizing in- 
formation to the network over the first encrypted and au- 
thenticated communication channel. If accepted, a sec- 
ond encrypted and authenticated communication chan- 
nel is established. The network then sends sensitive in- 
formation such as the root or A-key to the mobile over 
the second encrypted and authenticated communica- 
tion channel. 
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